Failed logins & brute force
Detects failed logins on any login endpoint, HTTP basic auth and WordPress – and raises a critical alert when a login succeeds after a brute-force wave.
SIEM for HTTP events
See every attack that reaches your web server.
Draxeno reads the access logs of your web server, detects brute force, injection attempts and scanners, opens tickets with evidence and lets you block attackers in one click – self-hosted, on your own server.
- No agents, no host setup
- Own database, no cloud
- Never in the request path
Critical
Open
2 min ago
Successful login after brute force
203.0.113.34 → app.example.com
22Failed logins
1Successful login
100 %AbuseIPDB
POST /api/auth/sign-in401POST /api/auth/sign-in401POST /api/auth/sign-in401POST /api/auth/sign-in200
10built-in detection rules
14threat tags per request
1built-in database
0changes on the host
Features
From raw access log to answered incident.
Everything a small team needs to notice, understand and stop attacks on its web applications.
Attack detection
SQL injection, XSS, path traversal, RCE and Log4Shell, probes for .env and .git, WordPress scans, scanner tools and direct-IP scans – classified as they arrive.
Origin & connection statistics
Requests per IP, country, city and network operator (ASN) on a world map, plus new IPs, error rates, response times and top paths.
IP reputation
Suspicious IPs are checked against AbuseIPDB and VirusTotal within the free quotas, cached, and shown next to every IP.
Rules as code
Write detection rules in RuleQL – a small query language with MATCH, EXCEPT, GROUP BY, thresholds, preconditions and cooldowns. Ten built-in rules included.
Tickets with evidence
Every triggered rule opens a ticket with a snapshot of the triggering requests, a summary, the surrounding traffic, IP intelligence and a recommended action.
One-click IP blocking
Block an IP or network from a ticket or the IP analysis. Your web server answers with 403 within seconds – permanent by default, without touching the host.
Email alerts
High and critical tickets are sent as plain-text email with the essentials and a direct link – at most once per ticket, rate-limited.
How it works
Five components, fully self-contained.
Draxeno sits next to your applications, not in front of them.
-
1
Web server
Writes every request to its access log – as web servers do anyway.
-
2
Ingest
Tails the log, adds GeoIP and ASN, classifies attacks, evaluates rules and writes in transactional batches.
-
3
Database
Date-partitioned raw data plus continuously updated aggregates keep dashboards fast at millions of requests.
-
4
Web UI
Dashboards, IP analysis, tickets, rules and blocks – in the browser, behind its own login.
-
5
Blocker
Turns manual blocks into a web server rule that answers blocked IPs with 403 – applied automatically.
RuleQL
Detection rules you can read.
Rules are written in RuleQL, a compact query language built for HTTP events. Combine conditions with
AND, OR and NOT, add exceptions, count per IP or host and require
preconditions – the editor validates as you type and shows the exact line and column of any error.
- Thresholds and distinct counts within time windows
- Preconditions such as “after 10 failed logins”
- Exceptions for your office, VPN or monitoring
- Dry run against the last hours before saving
# a successful login …
MATCH auth = success
# … from an IP that just failed 10 times
AFTER COUNT(auth = failed) >= 10 WITHIN 1h
EXCEPT ip IN (203.0.113.0/24)
GROUP BY ip, host
COOLDOWN 1hSecurity by design
A security tool should not be the weak spot.
Draxeno processes attacker-controlled data all day. It is built accordingly.
Self-hosted
Runs entirely on your own server with its own built-in database. No external database, no cloud service, no telemetry.
Isolated database
The database sits on an internal network: no internet, no proxy, no open ports.
Least privilege
The web UI reads logs but may only write rules, tickets and blocks. Every component runs with a read-only filesystem and without extra privileges.
Hardened UI
scrypt login with lock-out, signed HttpOnly cookies, CSRF origin checks, strict CSP and text-only rendering of attacker-controlled data.
Exactly-once ingest
Raw data, aggregates and the read position are written in one transaction – no gaps or double counts after restarts.
Privacy by default
Sensitive query parameters are redacted, cookies and authorization headers are never logged, retention is configurable.
Get Draxeno
An offer tailored to your setup.
Draxeno is licensed individually. Send us a short request and you will receive a personal offer.
Helpful details for your request
- Number of servers you want to protect
- Number of websites and domains
- Approximate number of requests per day
- Any special requirements
FAQ
Questions, answered.
What does Draxeno need to run?
A server with a web server whose access log is enabled. Draxeno brings its own database – nothing else is required.
Do I have to change my existing setup?
Hardly. Your web server only needs to write an access log. Draxeno reads the log without modifying it and enforces IP blocks through the web server's configuration.
Does any data leave my server?
Only if you enable it: IP reputation lookups send suspicious IP addresses to AbuseIPDB or VirusTotal, and email alerts go through your SMTP server. GeoIP databases are downloaded and queried locally.
Can I use an external database?
No – by design. Draxeno uses exactly one built-in database that is not reachable from outside.
Will it slow down my websites?
No. Draxeno never sits in the request path. It reads the web server's log afterwards; only manual IP blocks are enforced by the web server itself.
How long is data kept?
You decide. Individual requests and aggregated statistics have separate retention periods. Old data is dropped per partition, which is instant even for millions of rows.
How can I get Draxeno?
Send a request to info@micgram.de and you will receive an individual offer for your setup.
Know who is knocking.
Run Draxeno next to your applications and see your HTTP traffic the way an attacker does.